keybase / keybase/keybase-issues

The Keybase web verification is absolutely broken and does not handle redirects.

Open
#1,283 17 comments 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
899
Forks
40
PR merge metrics
No merged PRs in 30d

Description

Hello,

It seems that keybase wants a 200 response to a HTTP(S) request in order to prove that a host is up.
Instead, my host returns a 301 redirect on HTTP requests - a redirect to HTTPS.

This a very real-world scenario and is completely in line with the current web standards. It appears that Keybase does not follow the web standards, but instead uses a very hacky mechanism to check for whether a website is online.

In addition, the error message Keybase gives when a web verification fails is extremely vague. One cannot tell the difference of "I am not going to return true because I hate you" and "There is a problem with the website's certificate".

On attempt to verify my website by the CLI, I get a

```
error: Failed to find a connection to www.michael.yoo.id.au (error #229)
```

This is not only me, but many, many others who are reporting the same issue:
https://github.com/keybase/keybase-issues/issues/962
https://github.com/keybase/keybase-issues/issues/677

The web interface has the same issue.

Keybase must change it's mechanism for checking whether a website is online. The current system is broken and does not cover all scenarios. Keybase should also follow redirect headers, and output a better error message for the users to better understand whether the problem is of their own fault, or is a bug.

---

/end wall of text

But seriously, can you fix this bug and use better error messages? Thanks!

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce the reported failure through both the CLI and web interface using an HTTP request that returns a 301 redirect to HTTPS, and compare it with the error #229 output. Review the related issues for expected behavior; done should include redirect handling and error messages that distinguish certificate, connection, and verification failures.

Written by the indexing model from the issue text.

Assessment

Domain
cli, security, web-dev
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.